A low‑privileged authenticated user can submit a small request containing a forged opaque identifier. Elasticsearch decodes and deserializes that identifier before verifying its legitimacy, and an embedded size value drives a memory allocation that is not capped by the cluster’s memory‑usage controls. The resulting out‑of‑memory condition is fatal, causing the node process to terminate and creating a denial of service of the affected node.

Elastic Elasticsearch – any instance that accepts authenticated requests and has not yet applied the fix for this flaw. No specific version range is listed, so all versions prior to the security update that addresses this issue are potentially vulnerable.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score is not available, so it is unknown how frequently this flaw is exploited in the wild. The vulnerability is not listed in CISA’s KEV catalog. Attackers must be able to authenticate to the cluster with low privileges, so the attack vector is likely an authenticated local or network user rather than a purely remote unauthenticated agent. If exploited, a single crafted request can bring the node to a halt, disrupting cluster availability.